e4de650a43c843e0831493554a2d10c81b2063056bb667b09907c6286740700e

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0f834d9acbd24061a8dfe9120344fe7b.html
Size

84KB
MD5

0f834d9acbd24061a8dfe9120344fe7b
SHA1

44be4cc4db4ad3acc9bd9cf97083729a0cd2827c
SHA256

e4de650a43c843e0831493554a2d10c81b2063056bb667b09907c6286740700e
SHA512

b4621b086fbba341107f001280a33d9fcb7c88bd638c224a3c7a03d6caccc22f08471167e94c16172994c8d60ad8a1da51856675c91112b10ac3b8fd5c8ff577
SSDEEP

1536:2KWV/P7DG0lBlXnyI6JgRDvLB8wE+sLIg:i7C0PlXH6Hh+sLIg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
1948	msedge.exe
1948	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4740	identity_helper.exe
4740	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 3416	1948	msedge.exe	82
PID 1948 wrote to memory of 3416	1948	msedge.exe	82
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4452	1948	msedge.exe	83
PID 1948 wrote to memory of 4772	1948	msedge.exe	84
PID 1948 wrote to memory of 4772	1948	msedge.exe	84
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85
PID 1948 wrote to memory of 1312	1948	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0f834d9acbd24061a8dfe9120344fe7b.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9255346f8,0x7ff925534708,0x7ff925534718
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16671764195896248963,3489208072903328240,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f0e28ee19633a29d95467eaa43dc2486

SHA1
33b42a5fc377d9bf525da8bf7f25e52d163d3c5e

SHA256
e45090bfe510c508572694b2145cdac3e0ca6e83fb54f403e890723e19d7cb0d

SHA512
c29332d641ecdaa27e91b49f4987ec6804d6e6fd89fad3ae0d60d4c27b6a4b7d632d79aab66092277dd3ced1b188009adc83ebdb866d7bfebe57367dfcda8396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
68960d6c215a45c58ef0274b0ebd1fc3

SHA1
58482dd9a3f82720d8a42136277c68d3d1977e80

SHA256
54b66d9dc642325884d73798d93fc85845093c81de696b7e7bef851312c37856

SHA512
6b7a52d898c3fe05b2c9be29307dae190a18f65504007939bdbed87aaef526064d224d757e82f1790bc8d021cb112752f64477fcd03a92efdb9877aa99fc3fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bb956dc6c5e84a37e7e91fdf8baf1174

SHA1
59df8f7af173b1bb0c84b97057b75cdfc19bf5a8

SHA256
eed41daabb87796bc98ada75c3325d1cda90097bbba27806845c946c9352a35d

SHA512
c90c6c4ccc8ce66500306e9754fea9366e34e7194c81da60aa1adc68e0e50a37b3e83d46158fd857fed72c73fa49798e6e7e7ee430683e78e82496c234408173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dd813fd857044b0374e20173c36957e9

SHA1
a45f775b22fb5a514d3dccef7b3bf16ff69696f6

SHA256
3f7d2814699bcb55abbd158ec59dec5f768826d5308d2334e157cd719ac74f2e

SHA512
51423098d553c08ce331d8e544a88a7e827c2c1a494ebd909063825d2ad3db039e93ab1c1c1379d66af2734817b6287bc98dcbd54c1a0e6e0a8abe4e4de0a783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5ef09ed1b65d17e66ecccbb6b536fe9c

SHA1
ec92160e280c77db321c4d2a631a34fb64587c05

SHA256
b6dcb71c8dba79fcc6475626f086a604c79daf86bbfe381874054b88b1211290

SHA512
046945670399abde366ffa9b9a239db0e78f414defebed85c5e1474fc42f3cf37d7ab043f3009a7ea0a54703fb895b9890271c81f43898c9546f715dc48461d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c23e8e03d71b0cddb3e06b9cf1ef1b7b

SHA1
434748d4f9ade0b3aea85989997fcedb00c07c5e

SHA256
1aaba889a4429f1e7f9822296d0f84c5939b61f8485d4291bd2762b84782aaa2

SHA512
2717189f50393a22a7b488cf9960082c0efeb89835fb0e635fe46fd10a7e04a3afc7d987d22156da3723442dc2cedac79aad5ef216880c7d2cd089b48cee0716

Download Submit